2

I have an application that uses the Ent Lib 4.1 logging application block. This application runs on XP SP2+, Windows Vista, and Windows 7.

Most of the time, my logging works fine. (It typically targets the Event Log trace listener.) Sometimes, and I'm not sure what triggers it, a Windows XP machine will simply stop logging. I've tried adding a flat file trace listener to see if the issue was with the Event Log, but the flat file doesn't work either. Rebooting doesn't fix it either.

On all of the machines where it fails, it had been working previously. It also seems isolated to Windows XP SP2/SP3. It doesn't happen on Vista or 7.

Ideas?

Update: I tried removing all trace listeners except for the flat file, and this worked. So the issue is with the event log trace listener, and apparently whatever is happening is causing the Ent Lib to completely fail to log anything - including errors regarding the logging process.

RMD
  • 3,421
  • 7
  • 39
  • 85

2 Answers2

3

@RMD, you are right. When an exception is raised (e.g. Event Log is full) then the exception causes all other trace listeners for that category to not be processed.

no log entry will be recorded for any trace listener.

That, on the other hand, is not entirely true. Yes, all of the regular trace listeners will not be processed but there is still the the errors Special Source. I would recommend setting this to its own file (in my experience the EventLog will give more issues with permissions etc.) to capture any logging errors: 

<specialSources>
  <errors switchValue="All" name="Logging Errors &amp; Warnings">
    <listeners>
      <add name="Error Flat File Destination" />
    </listeners>
  </errors>
</specialSources>

If that was setup with proper permissions and the disk was not full (etc.) then you would have seen the error in that log file along with the original information:

Message: Tracing to LogSource 'Your Event Source' failed. Processing for other sources will continue. See summary information below for more information. Should this problem persist, stop the service and check the configuration file(s) for possible error(s) in the configuration of the categories and sinks.

Summary for Enterprise Library Distributor Service:
======================================
[Original Log Entry]

Exception Information Details:
====================================== 
Exception Type: System.ComponentModel.Win32Exception
NativeErrorCode: 1502 
ErrorCode: -2147467259 
Message: The event log file is full 
Data: System.Collections.ListDictionaryInternal
TargetSite: Void InternalWriteEvent(UInt32, UInt16, System.Diagnostics.EventLogEntryType, System.String[], Byte[], System.String) 
HelpLink: NULL 
Source: System

So, you will get your original log information which you may be able to extract and manually insert into any log history that you are saving (e.g. reporting, analysis). Plus as a bonus you get the information about why the log entry could not be written so that it can (hopefully!) be remediated.

Randy Levy
  • 22,566
  • 4
  • 68
  • 94
1

I figured it out. Apparently, if one trace listener fails for a category, no log entry will be recorded for any trace listener. In other words, if the event log trace listener fails, the flat file trace listener will never be called.

In my case, the event log was full on the XP machine. This was causing the event log trace listener to fail.

RMD
  • 3,421
  • 7
  • 39
  • 85